CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service:
Service A makes a request to Service B on behalf of a user. The request includes a perishable token (proxy ticket) from the authentication server. Service B forwards the token to the authentication server, asking if it's valid.
It seems like it could be more efficient to have the authentication server sign the ticket, and have Service B know the server's public key so that it can validate the ticket on its own, with no need for the extra request. Obviously any single-sign-out functionality would have to be left to Service A, but otherwise this seems like all-upside: it's more robust in the face of network latency or the auth server going down, and it's even harder to brute-force than a random token.
Are there downsides or risks that I'm missing? Has anybody actually implemented this?